On Action Theory Change

As historically acknowledged in the Reasoning about Actions and Change community, intuitiveness of a logical domain description cannot be fully automated. Moreover, like any other logical theory, action theories may also evolve, and thus knowledge engineers need revision methods to help in accommodating new incoming information about the behavior of actions in an adequate manner. The present work is about changing action domain descriptions in multimodal logic. Its contribution is threefold: first we revisit the semantics of action theory contraction proposed in previous work, giving more robust operators that express minimal change based on a notion of distance between Kripke-models. Second we give algorithms for syntactical action theory contraction and establish their correctness with respect to our semantics for those action theories that satisfy a principle of modularity investigated in previous work. Since modularity can be ensured for every action theory and, as we show here, needs to be computed at most once during the evolution of a domain description, it does not represent a limitation at all to the method here studied. Finally we state AGM-like postulates for action theory contraction and assess the behavior of our operators with respect to them. Moreover, we also address the revision counterpart of action theory change, showing that it benefits from our semantics for contraction.


Introduction
Consider an intelligent agent designed to perform rationally in a dynamic world, and suppose that she should reason about the dynamics of an automatic coffee machine ( Figure 1). NiceCafé $ Figure 1: The coffee deliverer agent.
Suppose, for example, that the agent believes that coffee is always a hot beverage. Suppose now that some day she gets a coffee at the machine and observes that it is cold. In such a case, the agent must change her beliefs about the relationship between the two propositions "I hold a coffee" and "I hold a hot drink". This example is an instance of the problem of changing propositional belief bases and has been largely addressed in the c 2010 AI Access Foundation. All rights reserved. literature about belief revision (Alchourrón, Gärdenfors, & Makinson, 1985;Gärdenfors, 1988;Hansson, 1999) and belief update (Katsuno & Mendelzon, 1992).
Next, let our agent believe that whenever she buys a coffee from the machine, she gets a hot drink. This means that in every state of the world that follows the execution of buying a coffee, the agent ends up with a hot drink. Now, in a situation where the machine is running out of cups, after buying, the coffee runs through the shelf and the agent, contrary to what she was expecting, does not hold a hot drink in her hands.
Imagine now that the agent never considered any relation between buying a coffee on the machine and its service availability, in the sense that she always believed (quite reasonably) that buying does not prevent other users from using the machine. Nevertheless, someday our agent is queuing to buy a coffee and observes that just after the agent before her has bought, the machine went out of order (maybe due to a lack of coffee powder).
Completing our agent's struggle in discovering the intricacies of operating a coffee machine, let us suppose now that she always believed that if she has a token, then it is possible to buy coffee, provided that some other preconditions like being close enough to the button, having a free hand, etc, are satisfied. Eventually, due to a blackout, the agent realizes that she does not manage to buy her coffee, even with a token.
The last three examples illustrate cases in which changing the beliefs about the behavior of the action of buying coffee is mandatory. In the first one, buying coffee, once believed to have a deterministic outcome, namely always a hot drink, has now to be seen as nondeterministic or, alternatively, to have a different effect in a more specific context (e.g. if there is no cup in the machine). In the second example, buying a coffee is now known to have side-effects (ramifications) which one was not aware of. Finally, in the last example, the feasibility of the action under concern is questioned in the light of new information showing a context that was not known to preclude its execution.
Such cases of theory change are very important when one deals with logical descriptions of dynamic domains: it may always happen that one discovers that an action actually has a behavior that is different from that one has always believed it had.
Up to now, theory change has been studied mainly for knowledge bases in classical logics, both in terms of revision and update. Since the work by Fuhrmann (1989), only in a few recent studies has it been considered in the realm of modal logics, viz. in epistemic logic (Hansson, 1999) and in dynamic logics (Herzig, Perrussel, & Varzinczak, 2006). Recently some studies have investigated revision of beliefs about facts of the world (Shapiro, Pagnucco, Lespérance, & Levesque, 2000;Jin & Thielscher, 2005) or the agent's goals (Shapiro, Lespérance, & Levesque, 2005). In our scenario, this would concern for instance the truth of token in a given state: the agent believes that she has a token, but is actually wrong about that. Then she might subsequently be forced to revise her beliefs about the current state of affairs or change her goals according to what she can perform in that state. Such belief revision operations do not modify the agent's beliefs about the action laws. On the other hand, here we are interested exactly in such modifications. Starting with Baral and Lobo's work (1997), some recent studies have been done on that issue (Eiter, Erdem, Fink, & Senko, 2005) for domain descriptions in action languages (Gelfond & Lifschitz, 1993).
We here take a step further in this direction and propose a method which is more robust by integrating a notion of minimal change and complying with postulates of theory change.
The present text is structured as follows: in Section 2 we establish the formal background that will be used throughout this article. Sections 3-6 are the core of the work: in Section 3 we present the central definitions for a semantics of action theory change, providing justifications for the design choices here made (Section 4). Section 5 is devoted to the syntactical counterpart of our operators while Section 6 to the proof of its correspondence with the semantics under certain acceptable conditions. In Section 7 we discuss some postulates for contraction/erasure and then present a semantics for action theory revision (Section 8). After a discussion on and comparison with existing work in the field (Section 9), we conclude with an overview and future directions of research.

Logical Preliminaries
Following the tradition in the Reasoning about Actions and Change (RAC) community, we consider action theories to be finite collections of statements that have the particular form (Shanahan, 1997): • if context, then effect after every execution of action (effect laws); • if precondition, then action executable (executability laws).
Statements mentioning no action at all represent laws about the underlying structure of the world, i.e., its possible states (static laws).
Here we opt to formalize action theories using the multimodal logic K n (Popkorn, 1994). Among the main reasons for such a choice are: • We benefit from the well defined semantics for multimodal logics which, as we are going to see in the sequel, provides simple and intuitive foundations on which to build the meaning of changing action domain descriptions.
• K n syntax allows us to express all the afore mentioned types of laws without requiring the full expressiveness of PDL or the machinery of a first-order language.
• Since K n is the core of all above mentioned PDL-based action formalisms, all we shall say in the sequel should smoothly transfer to them.
• Contrary to first-order based approaches, K n is decidable and has several implemented theorem provers for it available in the literature.

Action Theories in Multimodal Logic
Let Act = {a 1 , a 2 , . . . , a n } be the set of all atomic action constants of a given dynamic domain. An example of atomic action is buy. To each atomic action a there is associated a modal operator [a]. We here suppose that our multimodal logic is independently axiomatized (Kracht & Wolter, 1991), i.e., the logic is a fusion and there is no interaction between the different modal operators. 1 Prop = {p 1 , p 2 , . . . , p n } denotes a finite set of propositional constants, also called fluents or elementary atoms. Examples of those are token ("the agent has a token") and coffee ("the agent holds a coffee"). Lit = {p, ¬p : p ∈ Prop} is the set of literals. We use to denote a literal. If = ¬p, then we identify ¬ with p. By | | we denote the atom in .
We use small Greek letters ϕ, ψ, . . . to denote Boolean (propositional) formulas. They are recursively defined in the usual way: Fml is the set of all Boolean formulas. An example of a Boolean formula is coffee → hot. A propositional valuation v is a maximal consistent set of literals. We denote by v ϕ the fact that v satisfies a propositional formula ϕ. By val(ϕ) we denote the set of all valuations satisfying ϕ. By CPL we denote Classical Propositional Logic and |= CPL is its respective consequence relation. Cn(ϕ) denotes all logical consequences of ϕ in CPL, i.e., Cn(ϕ) = {ψ : ϕ |= CPL ψ}.
We denote complex formulas (possibly with modal operators) by Φ, Ψ, . . . They are recursively defined in the following way: a is the dual operator of [a], defined by a Φ = def ¬[a]¬Φ. An instance of a complex formula in our scenario example is ¬coffee → [buy]coffee.
The semantics here is the standard semantics of multimodal logic K n (Popkorn, 1994).
Definition 2.1 (K n -Model) A K n -model is a tuple M = W, R where W is a set of valuations (also called possible worlds), and R maps action constants a to accessibility relations R a ⊆ W × W.
As an example, for Act = {a 1 , a 2 } and Prop = {p 1 , p 2 }, we have the K n -model M = W, R , where Notice that our definition of K n -model does not follow the traditional notion from modal logics: here no two worlds satisfy the same valuation. This is a pragmatic choice, as we will see in Section 5. Nevertheless, all we shall say in the sequel can be straightforwardly formulated for standard K n models as well.

Definition 2.3 (Global Consequence)
A formula Φ is a global consequence of a set of global axioms Σ in the class of all K n -models (noted Σ |= Kn Φ) if and only if for every With K n we can state laws describing the behavior of actions. One way of doing this is by stating some formulas as global axioms. 2 As usually done in the RAC community (Shanahan, 1997), we here distinguish three types of laws. The first kind of statements are static laws, which are constraints on the allowed states of a dynamic domain.
Definition 2.4 (Static Law) A static law is a global axiom ϕ ∈ Fml.
An example of a static law is coffee → hot, saying that if the agent holds a coffee, then she holds a hot drink. In the Situation Calculus formalism (Reiter, 2001) one would write the first-order formula ∀s.[coffee(s) → hot(s)]. The set of all static laws of a scenario is denoted by S ⊆ Fml. In our example we will have S = {coffee → hot}.
The second kind of action law we consider is given by the effect laws. These are formulas relating an action to its effects, which can be conditional.
Definition 2.5 (Effect Law) Let ϕ, ψ ∈ Fml. An effect law for action a is a global axiom of the form ϕ → [a]ψ.
The consequent ψ is the effect which always obtains in accessible states (which need not exist in general) when action a is executed in a state where the antecedent ϕ holds. In our Kripke semantics, this means that in every possible world where ϕ holds, every transition by an a-labeled arrow (if any) leads to a possible world where ψ holds. If a is a nondeterministic action, then the consequent ψ is typically a disjunction. An example of an effect law is ¬coffee → [buy]coffee, saying that in a situation where the agent has no coffee, after buying, the agent has a coffee. If ψ is inconsistent, then we have a special kind of effect law that we call an inexecutability law. For example, we could also have ¬token → [buy]⊥, expressing that buy cannot be executed if the agent has no token. In the Situation Calculus our examples of effect and inexecutability laws would be expressed respectively as ∀s.[¬coffee(s) → coffee(do(buy, s))] and ∀s.[¬token(s) → ¬Poss(buy, s)].
The set of effect laws of a given scenario is denoted by E . In our coffee machine scenario, we could have for example: Finally, we also define executability laws, which stipulate the context where an action is guaranteed to be executable. In K n , the operator a is used to express executability. a thus reads "the execution of a is possible". Formally, a being true in a world w means that there is at least one world w accessible from w via R a (cf. Definition 2.2).
Definition 2.6 (Executability Law) Let ϕ ∈ Fml. An executability law for action a is a global axiom of the form ϕ → a .
For instance, token → buy says that buying can be executed whenever the agent has a token. The set of all executability laws of a given domain is denoted by X . In our scenario example we will have X = {token → buy }.
Note that in principle one needs to know nothing about the accessible world w . However, a common (albeit tacit) assumption in the RAC community is that we state executability laws only for actions of which we know the effects, in other words act(X ) ⊆ act(E ).
In the Situation Calculus our example would be stated as ∀s.[token(s) → Poss(buy, s)]. However, we point out that, traditionally, in Reiter basic action theories (Reiter, 2001) executability laws and inexecutability laws are mixed together in the form of bi-conditionals like ∀s.[token(s) ↔ Poss(buy, s)], called precondition axioms. For a critique of such a practice and its implications in formalizing dynamic domains, see the work by Herzig and Varzinczak (2007).
With our three basic types of laws, we are able to define action theories: Definition 2.7 (Action Theory) Given any (possibly empty) sets of laws S , E , and X , T = S ∪ E ∪ X is an action theory.
Given an action theory T and an action a, E a (resp. X a ) will denote the set of only those effect (resp. executability) laws about a in E (resp. X ). T a = S ∪ E a ∪ X a is then the action theory for a.
It is worth noting that for a 1 , a 2 ∈ Act, a 1 = a 2 , the intuition is indeed that T a 1 and T a 2 overlap only on S , i.e., the only laws that are common to both T a 1 and T a 2 are the laws about the structure of the world. This requirement is somehow related with the underlying modal logic being independently axiomatized (see note above).

The Frame, Ramification and Qualification Problems
During the last 40 years, most of the effort in the reasoning about actions community has been devoted to searching for satisfactory solutions to the frame problem, the ramification problem and the qualification problem.
Roughly speaking, the frame problem (McCarthy & Hayes, 1969) relates to the need for inferring the persistence of some facts of the world after the execution of an action known not to affect them, without having to state that explicitly in the form of frame axioms. (Frame axioms are a special type of effect law, having the form → [a] , for ∈ Lit.) In our example, buying a coffee in a context where the agent has already got one does not make it lose the coffee: coffee → [buy]coffee should be a consequence of our theory. The ramification problem (Finger, 1987) comes from the observation that an action may have several possibly interdependent effects and stating all of them explicitly is a huge task. In our scenario, we want to be able to infer [buy]hot without saying it in the theory, and in such a way some intrinsic causal connection between coffee and hot is taken into account. Finally, the qualification problem (McCarthy, 1977) amounts to addressing the issue of ensuring that an action is executable in a given context. Specifying all the sufficient conditions for an action to be executable is an incredibly hard task. In our example, one may state token → buy , but it may well be the case that buying fails due to some condition unforeseen at design time, like the agent's arm being rusty and stuck.
For more on these core problems of the RAC community, the reader is referred to the book by Shanahan (1997).
For the sake of clarity, here we abstract from the frame and ramification problems, and suppose that the agent's theory already entails all the relevant frame axioms. We point out however that all we shall say could have been defined within a formalism with a solution to the frame and ramification problems. For instance, we could have used any suitable solution to the frame problem, like e.g. the dependence relation (Castilho et al., 1999), which is used in the work of , or a kind of successor state axioms in a slightly modified setting (Demolombe, Herzig, & Varzinczak, 2003). To make the presentation more clear to the reader, here we do not bother with a particular solution to the frame problem and just assume that all frame axioms can be inferred from the action theory. Actually we can suppose that all intended frame axioms are automatically recovered and stated in the theory, more specifically, in the set of effect laws.
Given the largely acknowledged difficulty of the qualification problem in the literature (Shanahan, 1997), we do not assume here any a priori solution to it. Instead, as tacitly assumed in many approaches to reasoning about actions (Castilho et al., 1999;Zhang & Foo, 2001;Reiter, 2001), we suppose that the knowledge engineer may want to state some (not necessarily fully specified) executability laws for some actions. These may be incorrect at the starting point (and in all probability they will be), but revising wrong executability laws is an approach towards its solution and one of the aims of this work. With further information the knowledge engineer will have the chance to change them so that eventually they will correspond to the intuition (cf. Sections 3 and 8).
Having agreed on these points, the action theory of our example will be:  Figure 3 below shows a K n -model for the action theory T above.
We are going to see in the sequel that the finite base T formalizing the action theory plays a role in the contraction of laws. In particular, the base representing the static laws turns out to be quite important. So given an action theory T, it will be useful to consider models of T whose possible worlds are all the possible valuations allowed by S : Definition 2.8 (Canonical Frame) Let T = S ∪ E ∪ X be an action theory. Then the tuple M can = W can , R can is the canonical frame of T if and only if: • W can = val(S ); and Figure 3: A model for our coffee machine scenario: b, t, c, and h stand for, respectively, buy, token, coffee, and hot.
The canonical frame of an action theory need not be one of its models.    Figure 4: The canonical model for the coffee machine scenario.
A proof of this theorem is given by Makinson (2007) and we do not state it here. Essentially, the theorem establishes that for every Boolean formula ϕ, there is a unique least set of elementary atoms such that ϕ may equivalently be expressed using only atoms from that set. Hence, Cn(ϕ) = Cn(ϕ * ).
Given a valuation v, v ⊆ v is a subvaluation. Given a set of valuations W, a subvaluation v satisfies a propositional formula ϕ modulo W (noted v W ϕ) if and only if v ϕ for all v ∈ W such that v ⊆ v. We say that a subvaluation v essentially satisfies ϕ (modulo W), A prime subvaluation of a formula ϕ is thus one of the weakest states of truth in which ϕ is true. Hence, prime subvaluations are just another way of seeing prime implicants (Quine, 1952) of ϕ. By base(ϕ, W) we will denote the set of all prime subvaluations of ϕ modulo W. Proof: Right to left direction is straightforward. For the left to right direction, if w ϕ, then w ϕ * . Let w ⊆ w be the least subset of w still satisfying ϕ * . Clearly, w is a prime subvaluation of ϕ modulo W, and then because w ∈w , the result follows. 2

Closeness between Models
When contracting a formula from a model, we will perform a change in its structure. Because there can be several different ways of modifying a model (not all of them minimal), we need a notion of distance between models to identify those that are closest to the original one. As we are going to see in more depth in the next section, changing a model amounts to modifying its possible worlds or its accessibility relation. Hence, the distance between two K n -models will depend upon the distance between their sets of worlds and accessibility relations. These here will be based on the symmetric difference between sets, defined as This is an extension of Burger and Heidema's relation (Burger & Heidema, 2002) to our modal case. It defines a lexicographic order on the set of all K n -models. Although simple, this notion of closeness turns out to be sufficient for our purposes here, as we shall see in the sequel. Notice that other notions of distance between models could have been considered as well, namely the cardinality of symmetric differences or Hamming distance. (See Section 4 for a discussion on this.)

Semantics of Action Theory Change
When admitting the possibility of a law Φ failing, one must ensure that Φ becomes invalid, i.e., not true in at least one model of the dynamic domain that is formalized. Because there can be lots of such models, we may have a set M of models in which Φ is (potentially) valid. Thus contracting Φ amounts to making it no longer valid in this set of models. What are the operations that must be carried out to achieve that? Throwing models out of M does not work, since Φ will keep on being valid in all models of the remaining set. Thus one should add new models to M. Which models? Well, models in which Φ is not true. But not any of such models: taking models falsifying Φ that are too different from our original models will certainly violate the principle of minimal change.
Hence, we shall take some model M ∈ M as basis and manipulate it to get a new model M in which Φ is not true. In our modal semantics, the removal of a law Φ from a model M = W, R means modifying the possible worlds or the accessibility relation in M so that Φ becomes false. Such an operation gives as result a set M − Φ of models each of which is no longer a model of Φ. But if there are several candidates, which ones should we choose? We shall take those models that are minimal modifications of the original M , i.e., those which are minimal with respect to our distance M between models. Of course, there can be more than one such an M that is minimal with respect to M . In that case, because adding just one of these new models is enough to invalidate Φ, we take all possible combinations M ∪ {M } of expanding our original set of models M by one of these minimal models. (Observe that this approach relates to orderly maxichoice contraction Hansson, 1999.) The result will be a set of sets of models. In each set of models there will be precisely one model M falsifying Φ.
It might be claimed that, as such, our contraction method described above does not respect the so-called principle of categorical matching: the input and output are different sorts of objects, namely a set of models and a set of sets of models. It is easy to see, however, that the reasoning above can be stated in such a way that each output set of models corresponds precisely to the result of one contraction operator, satisfying then the referred principle. The choice for defining the result of an operation as a set of possible outputs will become more clear in Section 5, where we are going to present algorithms that correspond exactly to our semantic constructions.

Model Contraction of Executability Laws
To contract an executability law ϕ → a from one model, intuitively we should remove transitions leaving ϕ-worlds. In order to succeed in the operation, we have to guarantee that in the resulting model there will be at least one ϕ-world with no departing a-arrow.
Just to provide the reader with an insight on how this operation would be carried out in the Situation Calculus, there one should look at a given situation s in which ϕ holds and then modify the interpretation of the predicate Poss(a) so that it becomes false in s. Like in our case, there may be many of such situations and then all of them must be taken into account. An essential difference here is that our Kripke structures are always finite, whereas the space of situations is possibly infinite (Reiter, 2001).
To get minimal change, we want such an operation of removing transitions to be minimal with respect to the original model: one should remove a minimum set of transitions which is sufficient to get the desired result.  Figure 4. When the agent discovers that even with a token she does not manage to buy a coffee any more, she has to change her models in order to admit (new) models with states where token is the case but from which there is no buy-transition at all. Because having just one such a world in each new model is enough, taking those resulting models whose accessibility relations are maximal guarantees minimal change. Hence we will have M −

Model Contraction of Effect Laws
When our agent discovers that there may be some cases where after buying she gets no hot drink, she must e.g. give up the belief in the effect law token → [buy]hot in her set of models. This means that token ∧ buy ¬hot shall now be admitted in at least one world of some of the new models of her set of beliefs. Therefore, to contract an effect law ϕ → [a]ψ from a given model, intuitively we have to add new transitions from ϕ-worlds to worlds not satisfying ψ. As we shall see, the great challenge in such an operation is precisely how to guarantee minimal change.
In our example, when contracting token → [buy]hot from the model of Figure 4 we shall add transitions from token-worlds to ¬hot-worlds. Because coffee → hot is a static law and so is ¬hot → ¬coffee, this should also give us buy ¬coffee in some token-world (¬coffee is causally relevant to ¬hot, i.e., to have ¬hot we must also have ¬coffee). This means that if we allow for buy ¬hot in some token-world, we also have to allow for buy ¬coffee in that same world. The same argument does not necessarily hold for token: allowing for buy ¬hot does not necessarily oblige us to allow for buy token in the respective world. This is because token is not relevant to ¬hot (as ¬coffee is). This means that we have the freedom either to allow for it or not.
Hence, in our running example we can add transitions from token-worlds to ¬hot ∧ ¬coffee ∧ token-worlds, as well as to ¬hot ∧ ¬coffee ∧ ¬token. This situation is depicted in Figure 6. For instance, we can add a new buy-arrow from the world {token, ¬coffee, ¬hot} to one of these candidates (Figure 7).
In the Situation Calculus, such a modification would be slightly different, but with the same intuition behind: one should look at a given situation s in which ϕ holds and then modify the interpretation of the fluents (atoms) in do(a, s), the situation resulting from performing a in s. Alternatively, new ϕ-situations should lead to at least one ¬ψ-situation. Figure 6: Candidate worlds to receive transitions coming from token-worlds. Figure 7: Two candidate new buy-arrows to falsify token → [buy]hot in M .
Notice however that this would require the addition of new whole branches to the tree-like first-order model induced by Reiter basic action theories (Reiter, 2001).
Back to our example, observe that adding the new transition to {token, ¬coffee, ¬hot} itself would make us lose the effect ¬token, true after every execution of buy in the original model (|= M token → [buy]¬token). How do we preserve this law while allowing for the new transition to a ¬hot-world? That is, how do we get rid of the effect hot without losing effects that are not relevant for that? We here develop an approach for this issue.
When adding a new transition leaving a world w we intuitively want to preserve as many effects as we had before doing so. To achieve this, it is enough to preserve old effects only in w (because the remaining structure of the model remains unchanged after adding the new transition). Of course, we cannot preserve effects that are inconsistent with ¬ψ (those will all be lost). Hence it suffices to preserve only the effects that are consistent with ¬ψ. To achieve that we must observe what is true in w and in the target world w : • The proper effects of the action in world w , i.e., what changes from w to w (w \ w) through the new execution of a must be what is obliged to be so: either because those literals that now change from w to w are necessary to having ¬ψ in w (like ¬coffee in our example) or because they are necessary to have another effect (independent of ¬ψ, like ¬token) in world w .
• The non-effects of action a in world w , i.e., what does not change from w to w (w ∩ w ) through a's new execution should be only what is allowed to be so: certain literals are never preserved (like token in our example), then when pointing the new transition towards a world where it does not change with respect to the leaving world (¬hot ∧ ¬coffee ∧ token in our example), we may lose effects that held in w before adding the transition.
This means that the only things allowed to change in the candidate target world must be those that are forced to change, either by some non-related law or because of having ¬ψ modulo a set of states W. In other words, we want the literals that (now) change from w to w to be at most those that are sufficient to get ¬ψ modulo W, while preserving the maximum of other effects. Every change beyond that is not an intended one. Similarly, we want the literals from w that are (now) preserved in the target world w to be at most those that are usually preserved in a given set of models. Every preservation beyond those may make us lose some law. This looks like prime implicants, and that is where prime subvaluations play their role: the worlds to which the new transition will point are those whose difference with respect to the departing world are literals that are relevant and whose similarity with respect to it are literals that we know do not change. • for all ∈ w \ w: Note that we need the set of models M (and here we can suppose it contains all models of the theory we want to change) because preserving effects depends on what other effects hold in the other models that interest us. We need to take them into account in the local operation of changing one model. (The reason we do not need M in the definition of the local, one model contraction of executability laws M − ϕ→ a is that when removing transitions there is no way of losing effects, as every effect law that held in the world from which a transition has been removed remains true in the same world in the resulting model.) Because having just one world where the law is no longer true in each model is enough, taking those resulting models whose accessibility relations are minimal with respect to the original one guarantees minimal change.
Now we can define the possible sets of models resulting from contracting an effect law from a set of models: In both cases where ϕ is not satisfiable in M or ψ is valid in M , of course our operator does not succeed in falsifying ϕ → [a]ψ (cf. end of Section 3.1). Again, this works as expected and it has to do with the Success Postulate (see also Section 7.2).

Model Contraction of Static Laws
When contracting a static law from a model, we want to admit the existence of at least one (new) possible state falsifying it. This means that intuitively we should add new worlds to the original model. (In a Situation Calculus setting that would correspond to allowing for situations not satisfying some of the domain constraints.) This is quite easy. A very delicate issue however is what to do with the accessibility relation: should new transitions leave/arrive at the new world? If no transition leaves the new added world, we may lose some executability law. If some transition leaves it, then we may lose some effect law, the same holding if we add a transition pointing to the new world. On the other hand, if no transition arrives at the new world, what about the intuition? Is it intuitive to have an unreachable state? (Similar issues would also arise in Situation Calculus interpretations, which means that they are independent of the underlying formalism.) All this discussion shows how drastic a change in the static laws might be: it is a change in the underlying structure (possible states) of the world! Changing them may have as an indirect, unexpected (and in all probability unwanted) consequence the loss of some effect law(s) or some executability law(s). What we can do is choose which type(s) of laws we may accept to lose in this process and then postpone their change (by the other operators).
Following the tradition in the RAC community, which states that executability laws are in general more difficult to formalize than effect laws, and therefore they are more likely to be incorrect (Shanahan, 1997), here we prefer not to change the accessibility relation, which means that we preserve effect laws and postpone the correction of executability laws, if required. (Remember that this is an approach towards a solution to the qualification problem -cf. Section 2.2 above.) One may argue that doing things this way makes our three operators incoherent in the sense that for effect and executability laws we adopt a minimal change approach, giving stronger theories, whereas for static laws we adopt a more cautious approach, giving weaker theories (see the next section). It is worth noting however that as largely recognized by the RAC community, the different laws of a domain description do not have the same status: a minimal change approach for static law contraction that preserves as many executability laws as possible, even if coherent, would definitely fail to cope with the qualification problem. Moreover, by propagating wrong executability laws, such a coherent method would definitely be less elaboration tolerant (McCarthy, 1998) than the one we are defining with regards to further modifications of the theory.
For those reasons, our contention here is that static law contraction should be cautious.
(For a detailed discussion on this, see Section 4.2 below and the end of Section 5.3.) The minimal modifications of one model are defined as usual: And now we define the sets of models resulting from contracting a static law from a given set of models: Definition 3.10 Let M be a set of models, and ϕ a static law. Then where M is the model in Figure 4, then contracting the static law coffee → hot from M would give us the resulting new set of models where each M i is as depicted in Figure 9 below.
¬t, c, ¬h It is only some executability laws that are potentially lost, due to the cautiousness of our approach. For instance, in M 1 above, it is no longer the case that token → buy is true, since now there is a world, namely w 7 , which does not satisfy it anymore. (In M 2 this executability law is still true in every possible world.) It is worth point out, however, how our approach is indeed in line with intuition: when learning that a new state is now possible, we do not necessarily know all the behavior of the actions in the new added state. We may expect some action laws to hold in the new world (see end of Section 5.3), but, with the information we dispose, not touching the accessibility relation is the safest way of contracting static laws (cf. Section 4.2 below).

Interlude
Before presenting the algorithmic counterpart of our action theory change operators, in this section we discuss alternatives to some of our technical constructions. We point out the issues that such alternatives would raise. We also provide more justifications for some of the design choices that have been made in the previous sections.

Other Distance Notions
Here we have defined and used a model distance which is based on the symmetric difference between sets (Definition 2.11). This distance is an extension to Kripke structures of Winslett's (1988) notion of closeness between propositional interpretations in the Possible Models Approach (PMA). Instead of it, however, we could have considered other distance notions as well, like Dalal's (1988) distance, Hamming distance (1950), or weighted distance. Due to space limitations, we do not develop a through comparison among all these distances here. (For more details, the reader may want to refer to Schlechta's 2004 book.) We nevertheless do show that with a cardinality-based distance, for example, we may not always get the intended result.
Let card(X) denote the number of elements in set X. Then suppose that our closeness between K n -models was defined as follows: Such a notion of distance is closely related to Dalal's (1988) closeness.
Because when contracting a static law ϕ from a model M we usually add one new possible world, it is easy to see that with this cardinality-based distance we get the same result in contract(M , ϕ) as with the distance from Definition 2.11.
When it comes to the contraction of action laws, and then changing the accessibility relations, however, this cardinality-based distance does not seem to fit with the intuitions. To witness, consider the model M in Figure 10, in which the law p 1 → a is true.  Figure 11: Models resulting from contracting p 1 → a in the model M of Figure 10.
Note that M is an intended contracted model: |= M p 1 → a . However, with the cardinality-based distance above we will get {M } −

Minimal Change v. Cautiousness
As usually done in the literature on classical belief revision, when defining a (traditional) theory change operator one must always make the fundamental decision which of two opposing principles should be the guiding one: that of minimizing change, which leads to strong modified theories, versus that of cautious change, which leads to weak theories. In this regard, one might argue that our action theory change operators are incoherent. That is because we adopt the first principle for the contraction of effect and executability laws, but then the latter principle for contraction of static laws. 3 It turns out, however, that this view is debatable. From a different perspective one can think of our three operators as being coherent in the following sense: all of them perform a version of maxichoice, namely the addition of precisely a single model to the original models of the theory. 4 In any case, in the sequel we give a justification for the behavior of our operators and show that there can be no such an operator for contraction of static laws that is not cautious while being coherent with the operators for contraction of effect and executability laws. (We say that an operator for static law contraction is coherent with respect to our operators for contraction of effect and executability laws if it also performs minimal change with respect to the other types of laws, i.e., if it preserves effect and executability laws.) Where does the claimed 'incoherence' come from? Here our contention is that it is inherent to the problem of action theory change itself, and not a flaw of our definitions. The justification is as follows. Remembering the intuitions for our semantic constructions, it is easy to see that for the contraction of executability laws knowledge about some action's feasibility (the transitions) is removed and only that. For the contraction of effect laws, a piece of knowledge is also added (the new transition), but notice that this one is 'guided' by some given concrete extra information, namely the ¬ψ effect that we want to allow. Now, for the contraction of static laws, notice that no extra information whatsoever is given about the new possible state which could guide the addition of some knowledge about the feasibility of an action. The only thing that we know is that the new world should exist. Nothing more is said about whether there should be any transition leaving it or arriving at it at all. This is a property of the problem per se: the problem of removing a static law does not mention executabilities, and it is just reflected by our operator.
Therefore, such an 'incoherence' is already in the problem, and as such it is not surprising to find it again in the proposed operators. These are designed to do what they are allowed to do given the constraints of the problem. Should we have more information in our hands regarding the new added state, a coherent version of the corresponding operator would have been defined. (See the discussion in Section 9 for a comparison with Eiter et al.'s 2005 constraint-based method for update of action theories.) Proposition 4.1 There is no minimal change operator for static law contraction that is coherent with our operators for contraction of effect and executability laws.
Proof: Suppose that we have a minimal change based (non-cautious) contraction operator for static laws that is coherent with the other operators. This operator must be such that when contracting ϕ ∈ Fml only formulas of the type of ϕ are removed (otherwise it is not coherent with the other operators). This means that both effect and executability laws should be preserved. In particular, this operator is coherent in this respect when contracting the formula p 1 → ¬p 2 from model M in Figure 12 below. M : Figure 12: Adding a transition from a new added world in the alternative semantics to static law contraction. M denotes the original model, while M shows the new added world and a candidate transition to add to R a .
Following the intuition about contraction of Boolean formulas, a new world, viz. the valuation {p 1 , p 2 }, is added to W in M . Because the operator in question is non-cautious, a transition should also be added from the new added world {p 1 , p 2 } in M , in order to preserve the executability law p 1 → a . Also because the operator is non-cautious, the effect law p 1 → [a]¬p 1 should be preserved. Hence, such a new transition should point neither to world {p 1 , ¬p 2 } nor to {p 1 , p 2 } itself. Now, if we direct the new transition to {¬p 1 , p 2 } (the only world that is left), we get the model M in Figure 12.
Observe that |= M (¬p 1 ∨ p 2 ) → [a]p 1 . However, |= M (¬p 1 ∨ p 2 ) → [a]p 1 : the operator makes us lose an effect law! This means that it is not coherent. In order for us to keep this effect law, the only option is not to direct the new transition to {¬p 1 , p 2 }. But then, no transition is added at all: the operator is cautious! Hence there is no such an operator for static law contraction that is based on minimal change and is coherent with the operators for the other laws. 2 The result above supports our contention that we cannot have a coherent set of minimal change operators for action theory contraction. This is a general result and it holds not only for modal-based approaches like ours, but it applies to any framework for reasoning about actions which is based on transition systems and which also allows for the three types of laws that we consider here.
Furthermore, the result also illustrates well the difference between action theory change and classical belief change. To witness, even though contraction of static laws amounts to propositional contraction of Boolean formulas, it remains a special case of the latter. The reason is that when contracting static laws one always asks "what happens to the laws of other types?", a question that is not asked in classical propositional contraction for the obvious reason that there simply there are no other types of formulas.

Syntactic Operators for Contraction of Laws
Once having given a semantic construction for action theory change, we now turn our attention to the definition of syntactic operators for changing sets of formulas describing a dynamic domain.
As Nebel (1989) says, "[. . . ] finite bases usually represent [. . . ] laws, and when we are forced to change the theory we would like to stay as close as possible to the original [. . . ] base." Hence, besides the definition of syntactical operators, we should also guarantee that they perform minimal change at the theory level. By that we mean that the resulting theory should of course not entail the law we want to contract the theory with, and it should also preserve as much of the previous knowledge as possible when performing syntactical manipulations on the laws in the original theory. Ideally, from the knowledge engineer's perspective, the modified theory should also keep a certain degree of resemblance with the original one: the resulting laws should be slight modifications of the relevant ones in the original action theory.
By T − Φ we denote in the sequel the result of contracting a law Φ from the set of laws T.

Contracting Executability Laws
For the case of contracting an executability law ϕ → a from an action theory, first we have to ensure that action a keeps its executability state in all those contexts where the antecedent ¬ϕ holds, if that is the case. We achieve that by strengthening the antecedents of the relevant executability laws. Second, in order to get minimality, we must make a executable in some contexts where ϕ is true, viz. all ϕ-worlds but one. Since there are possibly many different alternatives for that, this means that we can have several action theories as outcome. Algorithm 1 gives a syntactical operator to achieve this.
It can be easily checked that Algorithm 1 always terminates: the input action theory T is always finite; from finiteness of Prop follows that of atm(π), for any π ∈ IP(S ∧ ϕ). Moreover, the entailment problem of multimodal K is decidable (Harel et al., 2000), as is that of classical propositional logic. Therefore contracting executability laws is decidable. if T |= Kn ϕ → a and S |= CPL ¬ϕ then if S |= CPL (π ∧ ϕ A ) → ⊥ then /* it is an allowed state */ 7 /* construct a theory that is weaker for that state */ It is straightforward to see that Algorithm 1 above can be adapted to Situation Calculus action theories as well. The crucial point however would be its termination, since entailment in the Situation Calculus is in general undecidable.
In our running example, contracting the executability law token → buy from the action theory T would give us T − token→ buy = {T 1 , T 2 , T 3 }, where: Now all the knowledge engineer has to do is choose which theory is more in line with her intuitions and implement the required changes (cf. Figure 5).

Contracting Effect Laws
When contracting an effect law ϕ → [a]ψ from an action theory T, intuitively we should contract those effect laws that preclude ¬ψ in target worlds. In order to cope with minimality, we must change only those laws that are relevant to the unwanted ϕ → [a]ψ.
In other words, each (E ϕ,ψ a ) i is a support set for the effect law ϕ → [a]ψ in T. To make a parallel with the terminology usually adopted in the belief change community, we shall see each (E ϕ,ψ a ) i as a special type of kernel (Hansson, 1994) for the formula ϕ → [a]ψ.
According to Herzig and Varzinczak (2007), given any action theory one can always ensure that at least one support set for ϕ → [a]ψ exists. Now let The laws in E − a will serve as guidelines to get rid of [a]ψ in each ϕ-world allowed by the theory T: they are the effect laws to be weakened to allow for a ¬ψ in some ϕ-contexts. This resembles classical kernel contraction (Hansson, 1994): finding minimal sets implying a formula and changing them. A crucial difference, however, is that instead of completely removing a formula from each kernel, what we do here is weaken the laws.
When modifying the support sets, the first thing we must do is to ensure that action a still has effect ψ in all those contexts in which ϕ does not hold, if that is the case. This means we shall weaken the laws in E ϕ,ψ a specializing them to ¬ϕ. Now, we need to preserve all old effects in all ϕ-worlds but one. To achieve that we specialize the above laws to each possible valuation (maximal consistent conjunction of literals) satisfying ϕ but one. Then, in the left ϕ-valuation, we must ensure that action a has either its old effects or ¬ψ as outcome. We achieve that by weakening the consequent of the laws in E − a . Finally, in order to get minimal change, we must ensure that all literals in this ϕ-valuation that are not forced to change in ¬ψ-worlds should be preserved. We do this by stating an effect law of the form (ϕ k ∧ ) → [a](ψ ∨ ), where ϕ k is the above ϕ-valuation. The reason this is needed is clear: there can be several ¬ψ-valuations, and as far as we want at most one to be reachable from the ϕ k -world, we should force it to be the one whose difference to this ϕ k -valuation is minimal.
In Situation Calculus terms, all these syntactical operations would correspond to strengthening the right-hand side of the relevant successor state axioms and/or weakening their left-hand side. Alternatively, the same can be done with the original effect axioms, then recompiling them again into new successor state axioms afterwards.
The output of the operations described above will be a set of action theories which will be output to the knowledge engineer. Algorithm 2 below gives the operator.
10 /* allow for ¬ψ after a in this state */ Again, from the finiteness of the action theory T and that of atm(π), for any π ∈ IP(S ∧ ϕ), and from the decidability of multimodal K (Harel et al., 2000) as well as that of classical propositional logic, it can be easily verified that Algorithm 2 always terminates. Therefore, contracting effect laws is decidable. Of course, the complexity of computing all the support sets as well as the prime implicants is quite high (see Section 5.4 later on for a discussion on this matter).
For an example of execution of Algorithm 2, let us suppose that we want to contract the effect law token → [buy]hot from the action theory T of our running example. First we have to compute the support sets for token → [buy]hot in T (i.e., the minimal subsets of E buy which together with S entail token → [buy]hot). These are the following:  so that we preserve their effects in all possible contexts but token ∧ coffee ∧ hot. Now, in order to preserve some effects in token ∧ coffee ∧ hot-contexts while allowing for reachable ¬hot-worlds, the algorithm adds the laws: (token ∧ coffee ∧ hot) → [buy](coffee ∨ ¬hot), (token ∧ coffee ∧ hot) → [buy](hot ∨ ¬coffee) Now, we search all possible combinations of laws from E buy that apply on token ∧ coffee ∧ hot contexts and find token → [buy]¬token. Because ¬token must be true after every execution of action buy, we do not state the law (token ∧ coffee ∧ hot) → [buy](hot ∨ token), and end up with the following theory: On the other hand, if in our language we also had an atom p with the same theory T, then we should have added a law (token ∧ coffee ∧ hot ∧ p) → [buy](hot ∨ p) to meet minimal change by preserving effects that are not relevant to ¬ψ (cf. Definition 3.4).
The execution for contexts token ∧ ¬coffee ∧ ¬hot and token ∧ ¬coffee ∧ hot are analogous and the algorithm ends with T − token→[buy]hot = {T 1 , T 2 , T 3 }, where: Looking at Figure 8, we can see the correspondence between these theories and their respective models. It is now up to the knowledge engineer to look at these action theories and pick up the one corresponding to her expectations.

Contracting Static Laws
Finally, in order to contract a static law from a theory, we can use any contraction/erasure operator for classical logic that is available in the literature. Because contracting static laws means admitting new possible states (cf. the semantics), just modifying the set S of static laws may not be enough for the multimodal logic case. However, since in general we do not necessarily know the behavior of the actions in a new discovered state of the world, a careful approach is to change the theory so that all action laws remain the same in the contexts where the contracted law is the case. (The reader is invited to see that in the Situation Calculus by allowing a new situation to exist one may need to change the precondition axioms as well, which means that the problem here described is independent of the logical formalism chosen.) In our scenario example, if in contracting the static law coffee → hot the knowledge engineer is not really sure whether action buy is still executable or not, then she should weaken the set of executability laws specializing them to the context coffee → hot, and make buy a priori inexecutable in all ¬(coffee → hot)-contexts. It is worth noting that this is in line with the assumption commonly made in the RAC community according to which executability laws are by and large much more likely to be incorrect right from the beginning (Shanahan, 1997). Therefore extrapolating them to previously unknown states might (and in all probability will) result in the propagation of errors and, even worse, the loss of effect laws (remember the discussion in Sections 3.3 and 4.2). The operator given in Algorithm 3 formalizes this.
In our running coffee example, contracting the static law coffee → hot from the action theory T produces T − coffee→hot = {T 1 , T 2 }, where Observe that the effect laws are not affected at all by the change: as far as we do not pronounce ourselves about the executability of some action in the new added world, all the effect laws remain true in it.
If the knowledge engineer is not happy with (coffee ∧ ¬hot) → [buy]⊥, she can contract this formula from the theory using Algorithm 2. Ideally, besides stating that buy is executable in the context coffee ∧ ¬hot, we should want to specify its outcome in this context as well. For example, we could want (coffee ∧ ¬hot) → buy hot to be true in the result. This requires theory revision. See Section 8 for the semantics of such an operation.

Complexity Issues
While terminating, our algorithms come with a considerable computational cost: the K nentailment tests with global axioms in the beginning of the algorithms and inside the loops are known to be exptime-complete (Harel et al., 2000). The computation of all possible contexts allowed by the theory, namely p i ∈atm(π) all π ∈ IP(S ∧ ϕ), is clearly exponential. Moreover, the computation of prime implicants IP(.) might result in exponential growth (Marquis, 2000).
Given that theory change can be carried out offline, from the perspective of the knowledge engineer what is more important is the complexity of the size of the computed contracted theories: the number of formulas as well as the length of the modified ones. This plays an important role when deciding among several output theories which one corresponds to the knowledge engineer's expectations. In that matter, whereas the length of new added formulas may increase exponentially, with respect to the number of laws our results are positive: the size of the computed contracted theories is linear in the size of the original action theory. (Remember that card(X) denotes the number of elements in set X.) Proposition 5.1 Let T be an action theory, ϕ → a an executability law, and T ∈ T − ϕ→ a . Then card(T ) = card(T).
Proof: If T |= Kn ϕ → a , then T − ϕ→ a = {T}, and then T = T, from which the result follows. Suppose T |= Kn ϕ → a is the case. Then T is such that T = (T \ X a ) ∪ X a , where X a is obtained from X a in such a way that (ϕ i ∧ ϕ ) → a ∈ X a if and only if ϕ i → a ∈ X a , for a fixed ϕ . From this it follows card(X a ) = card(X a ). Now, card((T \ X a ) ∪ X a ) = card(T \ X a )+card(X a )−card((T \ X a ) ∩ X a ) = card(T)−card(X a )+ card(X a ) − card(∅) = card(T) − card(X a ) + card(X a ) − 0 = card(T).
• E a and E a are both obtained from E − a in such a way that (ϕ Given the arbitrary choice of the contraction operator for static laws, without loss of generality we can resort to a slightly modified version of it, viz. one that always gives us as result a set of static laws with the same cardinality as the original S . (This is possible since, contrary to E and X , a conjunction of static laws is still a static law, with no further rewriting.) By agreeing on that, the following proposition is straightforward: Proposition 5.3 Let T be an action theory, ϕ a static law, and T ∈ T − ϕ . Then card(T ) = card(T) + 1.
Propositions 5.1-5.3 are positive results: if the knowledge engineer can deal with the original action theory, then she will be able to deal with the output of the algorithms. (Observe that for a given T all the conditional frame axioms added to F a in the contraction of an effect law can be 'factored' into a single law, so that the resulting theory has a cardinality of at most card(T) + card(E − a ) + 1.) We finish this section by observing that the size of T − Φ , the set of resulting contracted theories, depends solely on the set of static laws plus the law we contract T with: Proposition 5.4 Let T be an action theory, and let Φ be a law such that T |= Kn Φ. Then Proof: The proof follows straightforwardly from the outermost loops in Algorithms 1-3. 2

Correctness of the Operators
We now address the correctness of our algorithms with respect to our semantics for contraction. Correctness here is understood as completeness and adequacy. Adequacy means that the algorithms output only theories whose models result from our semantic modifications of models of the original theory. Conversely, completeness says that every model resulting from the semantic modifications of models of the original theory is indeed a model of some theory output by the algorithm.

Challenges to Completeness and Adequacy
Let the theory T = {p 1 → a , (¬p 1 ∨ p 2 ) → [a]⊥, [a]¬p 2 } and consider its model M depicted in Figure 13. (Notice that T |= Kn ¬(p 1 ∧ p 2 ).) When contracting p 1 → [a]¬p 2 in M , we get M in Figure 13. Now contracting p 1 → [a]¬p 2 from T using Algorithm 2 gives T − Notice that the formula (p 1 ∧ ¬p 2 ) → [a](¬p 2 ∨ p 1 ) is put in T by Algorithm 2 because there is {p 1 } ⊆ Lit such that S |= CPL (p 1 ∧ p 2 ) → ⊥ and T |= Kn (p 1 ∧ ¬p 2 ) → [a]¬p 1 . It is M : This issue arises because Algorithm 2 tries to allow a transition from the p 1 ∧ ¬p 2 -world to a p 2 -world that is closest to it, viz. {p 1 , p 2 }, but has no way of knowing that such a world does not exist. A remedy for that is replacing the test T Kn (π ∧ ∈L ) → ⊥ for S CPL (π ∧ ∈L ) → ⊥, but that would increase even more the complexity of the algorithm. A better option would be to have S 'complete enough' to allow the algorithm to determine the worlds to which a new transition could exist. This problem occurs because, in our example, the worlds that are forbidden by T, e.g. {p}, are not preserved as such in T . When contracting an executability or an effect law, we are not supposed to change the possible worlds of a theory (cf. Section 3).
Fortunately correctness of the algorithms with respect to our semantics can be established for those action theories whose S is maximal, i.e., the set of static laws in S alone characterize what worlds are possible in the models of the theory. This is the principle of modularity (Herzig & Varzinczak, 2005b) and we briefly review it in the next section.

Modular Action Theories
A quite useful, albeit simple, property of domain descriptions in reasoning about actions is that of action theory modularity (Herzig & Varzinczak, 2005b).
Definition 6.1 (Modularity) An action theory T is modular if and only if for every Boolean formula ϕ ∈ Fml, if T |= Kn ϕ, then S |= CPL ϕ.
For an example of a non-modular theory, let us suppose that the action theory T of our coffee machine scenario were stated as The modified law is underlined: we have (in this case wrongly) stated that the agent can always buy at the machine. Then T |= Kn token, but S |= CPL token.
Since the underlying multimodal logic is independently axiomatized (see Section 2.1), we can use the algorithms given by Herzig and Varzinczak (2005b) to check whether an action theory satisfies the principle of modularity. Whenever this is not the case, the algorithms return the Boolean formulas entailed by the theory which are not consequences of S alone. For the theory T above, they would return {token}: as we have stated buy , from this and the inexecutability law ¬token → [buy]⊥ we have that T |= Kn token. Because S |= CPL token, token is what is called an implicit static law (Herzig & Varzinczak, 2004) of the action theory T. 5 Modular action theories have several interesting computational properties. For example, consistency can be checked by just checking consistency of the static laws in S : if T is modular, then T |= Kn ⊥ if and only if S |= CPL ⊥. Deduction of effect laws does not need the executability ones and vice versa. Deduction of an effect of a sequence of actions a 1 ; . . . ; a n (prediction) does not need to take into account the effect laws for actions other than a 1 , . . . , a n . This applies in particular to plan validation when deciding whether a 1 ; . . . ; a n ϕ is the case.
Modularity is not an exclusive property of action theories formalized in K n : similar notions have also been investigated for different contexts in other formalisms, like regulation consistency in deontic logic (Cholvy, 1999), Situation Calculus (Herzig & Varzinczak, 2005a), DL ontologies , dynamic logic (Zhang, Chopra, & Foo, 2002) and also in the Fluent Calculus (Thielscher, 2010). For more details on modularity in K n action theories, as well as its role in the presence of a solution to the frame and ramification problems, see the work by Varzinczak (2006). 5. Implicit static laws are closely related to veridical paradoxes (Quine, 1962). It turns out that sometimes they are intuitive, but sometimes they are not. For a deep discussion on implicit static laws, see the work by Varzinczak (2006).
Another interesting property of modular action theories is the following: (⇐): Suppose T is not modular. Then there must be some ϕ ∈ Fml such that T |= Kn ϕ and S |= CPL ϕ. This means that there is v ∈ val(S ) such that v ϕ. As v ∈ W can (because W can contains all possible valuations of S ), M can is not a model of T. 2

Correctness Under Modularity
As shown by Herzig and Varzinczak (2007), given an action theory formalized with any framework available in the literature allowing for the expression of our three basic types of laws, it is always possible to ensure modularity. Moreover, as we are going to see in the sequel (cf. Section 7.2), it has to be computed at most once during the evolution of the action theory. Hence, relying on modular theories is not a limitation at all to our approach.
The following theorem establishes that under the assumption that the action theory T is modular, the semantic contraction of a formula Φ from the set of models of T produces models of some contracted theory in T − Φ .
Theorem 6.2 Let T be modular, and Φ be a law. For all M ∈ M − Φ such that |= M T for The next theorem establishes the other way round: under modularity models of theories in T − Φ are all models of the semantic contraction of Φ from models of T.

Contraction or Erasure?
The distinction between revision/contraction and update/erasure for classical theories is historically controversial in the literature. The same is true for the case of modal theories describing actions and their effects. We here rephrase Katsuno and Mendelzon's definitions (1992) in our terms so that we can see to which one our method is closer.
In Katsuno and Mendelzon's view, contracting a law Φ from an action theory T intuitively means that the description of the possible behavior of the dynamic world T must be adjusted to the possibility of Φ being false. This amounts to selecting from the models of ¬Φ those that are closest to models of T and allow them as models of the result.
In contrast, update methods select, for each model M of T, the set of models of Φ that are closest to M . Erasing Φ from T means adding models to T; for each model M , we add all those models closest to M in which Φ is false. Hence, from our constructions so far it seems that our operators are closer to update than to revision.
Moreover, according to Katsuno and Mendelzon's view (1992), our change operators would also be classified as update because we make modifications in each model independently, i.e., without changing other models. 6 Besides that, in our setting a different ordering on the resulting models is induced by each model of the theory T (see Definitions 3.3, 3.7 and 3.10), which according to Katsuno and Mendelzon is a typical property of an update/erasure method. Nevertheless, things get quite different when it comes to the postulates for theory change.

The Postulates
In this section we analyze the behavior of our action theory change operators with respect to AGM-like postulates. Here we follow Katsuno and Mendelzon's presentation of the 6. Even if when contracting an effect law from one particular model we need to check the other models of the theory, those are not modified.
postulates to assess both contraction and erasure. Let T = S ∪ E ∪ X denote an action theory and Φ denote a law.
This postulate is our version of Katsuno and Mendelzon's (C1) and (E1) postulates for contraction and erasure, respectively, and it is satisfied by our change operators. The proof is in Lemma A.1. Such a postulate is not satisfied by the operators proposed by : there when removing e.g. an executability law ϕ → a one may make ϕ → [a]⊥ valid in all models of the resulting theory.
This is Katsuno and Mendelzon's (C2) postulate. Our operators satisfy it as far as whenever T |= Kn Φ, then the models of the resulting theory are exactly the models of T, because these are the minimal models falsifying Φ.
The corresponding version of Katsuno and Mendelzon's (E2) postulate about erasure, i.e., if T |= Kn ¬Φ, then |= Kn T ↔ T , for all T ∈ T − Φ , is clearly also satisfied by our operators as a special case of the postulate above. Satisfaction of (C2) indicates that our operators are closer to contraction than to erasure.
This postulate is our version of Katsuno and Mendelzon's (C3) and (E3) postulates. If Φ is a propositional ϕ ∈ Fml, our operators satisfy it, as long as the classical propositional change operator satisfies it as well. For the general case, however, as stated the postulate is not always satisfied. This is shown by the following example: let T = {¬p, a , p → [a]⊥}. Note that T is modular and consistent. Now, contracting the (contingent) formula p → a from T gives us T = T. Clearly T |= Kn p → a . This happens because, despite not being a tautology, p → a is a 'trivial' formula with respect to T: since ¬p is valid in all T-models, p → a is trivially true in these models (cf. end of Section 3.1).
Fortunately, for all those formulas that are non-trivial consequences of the theory, our operators guarantee success of contraction: Theorem 7.1 Let T be consistent, and Φ be an executability or an effect law such that S |= Kn Φ. If T is modular, then T |= Kn Φ for every T ∈ T − Φ .
Proof: Let us suppose that there is some T ∈ T − Φ such that T |= Kn Φ. Since T is modular, Corollary 6.1 tells us that |= Equivalences Postulate: If |= Kn T 1 ↔ T 2 and |= Kn Φ 1 ↔ Φ 2 , then |= Kn T 1 ↔ T 2 , for some T 1 ∈ (T 1 ) − Φ2 and T 2 ∈ (T 2 ) − Φ 1 . This postulate corresponds to Katsuno and Mendelzon's (C4) and (E4) postulates. It is worth noting that equivalence here is considered always modulo action laws, i.e., the formulas are assumed to be either static laws, effect laws or executability laws, as well as their equivalents. Moreover we remember that the theories here must be action theories, i.e., sets of action laws of our three basic types. Under modularity and the assumption that the propositional change operator satisfies (C4)/(E4), our operations satisfy this postulate: Theorem 7.2 Let T 1 and T 2 be modular. If |= Kn T 1 ↔ T 2 and |= Kn Φ 1 ↔ Φ 2 , then for each

and vice-versa.
Proof: The proof follows straight from our results: since |= Kn T 1 ↔ T 2 and |= Kn Φ 1 ↔ Φ 2 , they have pairwise the same models. Hence, given M such that |= M T 1 and |= M T 2 , the semantic contraction of Φ 1 and that of Φ 2 from M have the same operations on M . As T 1 and T 2 are modular, Corollary 6.1 guarantees we get the same syntactical results. Moreover, as the classical operator satisfies (C4)/(E4), if follows that |= Kn T 1 ↔ T 2 . 2 This is the action theory counterpart of Katsuno and Mendelzon's (C5) and (E5) postulates. Again we rely on modularity in order to satisfy it. 2 This is our version of (E8) erasure postulate by Katsuno and Mendelzon. Clearly our syntactical operators do not manage to contract a law from a disjunction of theories: T 1 ∨T 2 is not an action theory and cannot in general be rewritten as one. Nevertheless, by proving that it holds in the semantics, from the correctness of our operators, we get an equivalent operation. Again the fact that the theories under concern are modular gives us the result.
We have thus shown that our constructions satisfy the (E8) postulate. Nevertheless, as far as we see, it is not immediate whether it is really expected here. This supports our position that our operators' behavior is closer to contraction than to erasure.
As we have seen from the results above, modularity is a sufficient condition for the satisfaction of the AGM-like postulates for action theory contraction. To finish up we state a new postulate: Preservation of Modularity: If T is modular, then every T ∈ T − Φ is modular. Changing a modular theory should not make it non-modular. This is not a standard postulate, but we think that since it is a good property modularity should be preserved across changing an action theory. If so, this means that whether a theory is modular or not can be checked once for all and one does not need to care about it during the future evolution of the action theory, i.e., when other changes will be made on it. Our operators satisfy this postulate and the proof is given in Appendix B. Now one may naturally asks whether we can get a characterization result in the traditional AGM sense, i.e., whether any contraction operator satisfying all our versions of the postulates is one of our three contraction operations. Unfortunately, good sense points towards a negative answer: there might well be an operator satisfying all the above postulates that, by not complying with all the assumptions in the RAC community (Shanahan, 1997), is not necessarily one of the operators defined in Section 3 (cf. the discussion on general formula contraction in Section 10). To witness, consider for example an operator that also modifies worlds when contracting effect laws. This supports one of the contentions of the present work, viz. that classical belief change cannot be fully transposed to action theories and expected to give exactly the same kind of outcome. Similar negative results have also been found for revision in DL ontologies (Flouris, Plexousakis, & Antoniou, 2004) and contraction of Horn theories (Booth, Meyer, & Varzinczak, 2009).

A Semantics for Action Theory Revision
So far we have analyzed the case of contraction: the knowledge engineer realizes that the theory is too strong and therefore it has to be weakened. Let us now take a look at the other way round, i.e., the theory is (possibly) too liberal and the agent discovers new laws about the world that should be added to her beliefs, which amounts to strengthening them.
Suppose that the action theory of our scenario example were initially stated as follows:  Looking at model M in Figure 15 we can see that, for example, the agent does not know that she loses her token every time she buys coffee at the machine. This is a new law that she should incorporate to her knowledge base at some stage of her action theory evolution.
Contrary to contraction, where we want the negation of some law to become satisfiable, in revision we want to make a new law valid. This means that one has to eliminate all cases satisfying its negation. This depicts the duality between revision and contraction: whereas in the latter one invalidates a formula by making its negation satisfiable, in the former one makes a formula valid by forcing its negation to be unsatisfiable prior to adding the new law to the theory.
The idea behind our semantics for revision is as follows: we initially have a set of models M in which a given formula Φ is (potentially) not valid, i.e., Φ is (possibly) not true in every model in M. In the result we want to have only models of Φ. Adding Φ-models to M is of no help. Moreover, adding models makes us lose laws: the corresponding resulting theory would be more liberal.
One solution amounts to deleting from M those models that are not Φ-models. Of course removing only some of them does not solve the problem, we must delete every such a model. By doing that, all resulting models will be models of Φ. (This corresponds to theory expansion, when the resulting theory is satisfiable.) However, if M contains no model of Φ, we will end up with ∅. Consequence: the resulting theory is inconsistent. (This is the main revision problem.) In this case the solution is to substitute each model M in M by its nearest modification M Φ that makes Φ true. This lets us to keep as close as possible to the original models we had. But, what if for one model in M there are several minimal (incomparable) modifications of it validating Φ? In that case we shall consider all of them. The result will also be a list of models M Φ , all being models of Φ.
Before defining the revision of sets of models, we present what modifications of (individual) models are.

Revising a Model by a Static Law
Suppose that our coffee deliverer agent discovers that the only hot drink that is served on the machine is coffee. In this case, she might want to revise her beliefs with the new static law ¬coffee → ¬hot: she cannot hold a hot drink that is not a coffee.
Considering the model depicted in Figure 15, one can see that the Boolean formula ¬coffee ∧ hot is satisfiable (there is a world of the model in which it holds). Since we do not want this to be the case, the first step is to remove all worlds in which ¬coffee ∧ hot is true. The second step is to guarantee that all the remaining worlds (if any) satisfy the new static law. Such an issue has been largely addressed in the literature on propositional belief base revision and update (Gärdenfors, 1988;Winslett, 1988;Katsuno & Mendelzon, 1992;Herzig & Rifi, 1999). Here we can achieve that with a semantics similar to that of classical revision operators: basically one can change the set of possible valuations, by removing or adding worlds.
In our example, removing the possible worlds {t, ¬c, h} and {¬t, ¬c, h} would do the job (there is no need to add new valuations since the new incoming law is already satisfied in at least one world of the original model, and therefore the resulting set of worlds is non-empty).
The delicate point in removing worlds is that this may have as consequence the loss of some executability laws: in the example, if there were some transition from some world w to say {¬t, ¬c, h}, then removing the latter from the model would make the action under concern no longer executable in w, if it was the only transition labeled by that action leaving it. From a semantic point of view, this is intuitive: if the state of the world to which we could move is no longer possible, then we do not have a transition to that state anymore. Therefore, if that transition was the only one we had, it is natural to lose it.
Similarly, one could ask what to do with the accessibility relation if new worlds are added, i.e., when expansion is not possible. Following the discussion in Section 3.3, we here prefer not to add new transitions systematically to the accessibility relation. Hence we shall postpone correction of executability laws, if needed. This approach may be debatable, but with the information we have at hand, this is the safest way of changing static laws. (See also the discussion in Sections 3.3 and 4.2.) The semantics for revision of one model by a static law is as follows: In the example of model M in Figure 15, revise(M , ¬coffee → ¬hot) is the singleton {M }, where M is as shown in Figure 16.  Figure 16: Model resulting from revising the model M in Figure 15 with ¬coffee → ¬hot.

Revising a Model by an Effect Law
Let us suppose now that our agent eventually discovers that after buying coffee she does not keep her token anymore. (That was a design mistake that the agent still possesses a token even after ordering a coffee at the machine). This means that her theory should now be revised in such a way that the new effect law token → [buy]¬token holds. Looking at model M in Figure 15, this amounts to guaranteeing that the formula token ∧ buy token is satisfiable in none of its worlds. To do that, we have to look at all the worlds satisfying this formula (if any) and either (i) make token false in each of these worlds; or (ii) make buy token false in all of them. If we chose the first option, we will essentially flip the truth value of literal token in the respective worlds, which changes the set of valuations of the model. If we chose the latter, we will basically remove buy-arrows leading to token-worlds. In that case, a change in the accessibility relation will be made.
In our example, we have that the possible worlds {token, coffee, hot}, {token, ¬coffee, hot} and {token, ¬coffee, ¬hot} satisfy token ∧ buy token and all they have to change.
Flipping token in all these worlds to ¬token would do the job, but would also have as consequence the introduction of a new static law: ¬token would now be valid, i.e., the agent never has a token! Another issue with this approach is that by making ¬token true everywhere, the new incoming law token → [buy]¬token will be trivially true in the resulting model, which does not mean that there is an execution of action buy from a token-world to a ¬token one. This defeats the purpose of changing the action theory on the basis that it has been observed that every execution of the action under consideration should lead to ¬token-contexts.
One of our contentions in the present work is that changing action laws should never have as a side effect a change in the static laws (cf. Sections 3 and 4). Given their special status (Shanahan, 1997), these should change only if explicitly required. In this case, each world satisfying token ∧ buy token has to be changed so that buy token is no longer true in it.
The semantics of one model revision for the case of a new effect law is: ψ if and only if:  Figure 17: Model resulting from revising the model M in Figure 15 with the new effect law token → [buy]¬token.

Revising a Model by an Executability Law
Let us now suppose that in some stage it has been decided to grant free coffee to everybody. Faced with this information, the agent will now revise her laws to reflect the fact that buy can also be executed in ¬token-contexts: ¬token → buy is a new executability law (and therefore we will have buy in all new models of the agent's beliefs). Considering again the model in Figure 15, we observe that ¬(¬token → buy ) is satisfiable in M . This means that we must throw ¬token ∧ [buy]⊥ away to ensure that the new formula becomes true in the new model, i.e., satisfied by all of its worlds.
To remove ¬token ∧ [buy]⊥ we have to look at all worlds satisfying it and modify M so that they no longer satisfy that formula. Given worlds {¬token, ¬coffee, ¬hot} and {¬token, ¬coffee, hot}, we have two options: change the interpretation of token or add new transitions leaving these worlds. A question that arises is 'what choice is more drastic: change a world or a transition' ? Again, here we think that changing the world's content (the valuation) is more drastic, as the existence of such a world was foreseen by some static law and is hence assumed to be as it is, unless we have enough information supporting the contrary, in which case we explicitly change the static laws (see above). Moreover, changing the truth value of token in these worlds would trivialize the new incoming law ¬token → buy in the new model, defeating the purpose of guaranteeing the existence of a buy-transition from a ¬token-context. Therefore we shall add a new buy-arrow from each of {¬token, ¬coffee, ¬hot} and {¬token, ¬coffee, hot}.
Having agreed on that, the issue now is: which worlds should the new transitions be directed to? Recalling the reasoning developed in Section 3.2, in order to comply with minimal change, the new transitions shall be directed to worlds that are relevant targets of each of the ¬token-worlds in question. In our example, {¬token, coffee, hot} is the only relevant target world here: the two other ¬token-worlds violate the effect coffee of buy, while the three token-worlds would make us violate the frame axiom ¬token → [buy]¬token.
The semantics for one model revision by a new executability law is as follows: Definition 8.5 Let M = W, R . M = W , R ∈ M ϕ→ a if and only if: • If (w, w ) ∈ R \ R, then w ∈ RelTarget(w, ϕ → [a]⊥, M , M); and The minimal models resulting from revising a model M by a new executability law are those closest to M with respect to M : Definition 8.6 Let M be a model and ϕ → a be an executability law. revise(M , ϕ → a ) = min{M ϕ→ a , M }.
In our running example, revise(M , ¬token → buy ) is the singleton {M }, where M is as depicted in Figure 18.
In this example, observe that because we have a single relevant target world we get a single model in the result of revision.

Revising Sets of Models
Up until now we have seen what the revision of single models means. This is needed when expansion by the new law is not possible due to inconsistency. We here give a unified definition of revision of a set of models M by a new law Φ:  Figure 18: Result of revising M in Figure 15 by the new executability law ¬token → buy .
Definition 8.7 Let M be a set of models and Φ be a law. Then Observe that Definition 8.7 comprises both expansion and revision: in the first one, simple addition of the new law gives a satisfiable theory; in the latter a deeper change is needed to get rid of inconsistency.

Related Work
To the best of our knowledge, the first work on updating an action domain description is that by Li and Pereira (1996) in a narrative-based action description language (Gelfond & Lifschitz, 1993). Contrary to us, however, they mainly investigate the problem of updating the narrative with new observed facts and (possibly) with occurrences of actions that explain those facts. This amounts to updating a given state/configuration of the world (in our terms, what is true in a possible world) and focusing on the models of the narrative in which some actions took place (in our terms, the models of the action theory with a particular sequence of action executions). Clearly the models of the action laws remain the same. Baral and Lobo (1997) introduce extensions of action languages that allow for some causal laws to be stated as defeasible. Their work is similar to ours in that they also allow for weakening of laws: in their setting, effect propositions can be replaced by what they call defeasible (weakened versions of) effect propositions. Our approach is different from theirs in the way executability laws are dealt with. Here executability laws are explicit and we are also able to contract them. This feature is important when the qualification problem is considered: we may always discover contexts that preclude the execution of a given action (cf. the Introduction).
Liberatore (2000) proposes a framework for reasoning about actions in which it is possible to express a given semantics of belief update, like Winslett's (1988) and Katsuno and Mendelzon's (1992). This means it is the formalism, essentially an action description lan-guage, that is used to describe updates (the change of propositions from one state of the world to another) by expressing them as laws in the action theory.
The main difference between Liberatore's work (2000) and Li and Pereira's (1996) is that, despite not being concerned, at least a priori, with changing action laws, Liberatore's framework allows for abductively introducing in the action theory new effect propositions (effect laws, in our terms) that consistently explain the occurrence of an event.
The work by Eiter et al. (2005) is similar to ours in that they also propose a framework which is oriented to updating action laws. They mainly investigate the case where e.g. a new effect law is added to the description (and then has to be true in all models of the modified theory). This problem is the dual of contraction and is then closer to our definition of revision (cf. Section 8).
In Eiter et al.'s framework (2005), action theories are described in a variant of a narrativebased action description language. Like in the present work, the semantics is also in terms of transition systems, with transitions (action occurrences) linking states (configurations of the world). Contrary to us, however, the minimality condition on the outcome of the update is in terms of inclusion of sets of laws, which means that the approach is more syntax oriented to some extent.
In their setting, during an update an action theory T is seen as composed of two pieces, T u and T m , where T u stands for the part of T that is not supposed to change and T m contains the laws which may be modified. In our terms, when contracting a static law we would have T m = S ∪ X a ; when contracting an executability law T m = X a ; and when contracting effects laws T m = E − a . The difference here is that in our approach it is always clear what laws should not change in a given type of contraction, and therefore T u and T m do not need to be explicitly specified prior to the update.
Their approach and ours can both be described as constraint-based update, in that the theory change is carried out relative to some constraints (a set of laws that we want to hold in the result). In our framework, for example, all changes in the action laws are relative to the set of static laws S (and that is why we concentrate on models of T having val(S ) as worlds). When changing a law, we want to keep the same set of states. The difference with respect to Eiter et al.'s (2005) approach is that there it is also possible to update a theory relatively to e.g. executability laws: when expanding T with a new effect law, one may want to constrain the change so that the action under concern is guaranteed to be executable in the result. 7 As shown in the referred work, this may require the withdrawal of some static law. Hence, in Eiter et al.'s framework, static laws do not have the same status as in ours.  define a method for action theory contraction that, despite the similarity with the current work and the common underlying motivations, is more limited than the present constructions.
First, with the referred approach we do not get minimal change. For example, in the referred work the operator for contracting executability laws is such that in the resulting theory the modified set of executability laws is given by . We could simulate that in our approach with two successive modifications of T: first adding the effect law and then an executability law (cf. Section 8).
which, according to its semantics, gives theories among whose models are those resulting from removing transitions from all ϕ-worlds. A similar comment can be made with respect to contraction of effect laws. Second, Herzig et al.'s (2006) contraction method does not satisfy most of the postulates for action theory change that we have addressed in Section 7. Besides not satisfying the monotonicity postulate, it does not satisfy the preservation one. To witness, suppose that we have a language with only one atom p, and the model M depicted in Figure 19.   Figure 19 such that R a = W×W.
Then |= M p → [a]¬p, i.e., the effect law p → [a]¬p is not preserved.
Finally, another work that is related to ours is that by Zhang and Ding (2008). Like ours, their approach is also about giving a semantic characterization of the basic operations for changing Kripke models. Contrary to us however, their focus is on model checking, not on entailment. Despite the definition and use of operations that in essence are similar to ours (modifications of the set of possible worlds or of the accessibility relation), their work is concerned mainly with modifications of a single model, not with that of sets of models as we do, and hence it does not provide operations for changing action laws. Because of that, their approach is not directly comparable to ours, since here we are interested in entailment-based revision.

Concluding Remarks
In this work we have addressed the problem of changing an action domain description for reasoning about actions, a problem not sufficiently investigated in the literature so far. We have seen the intuitions behind such a kind of theory modification and have given a semantics for action theory change in terms of distances between models that captures the notion of minimal change. We have given algorithms to contract a formula from a theory that terminate and that are correct with respect to our semantics (Corollary 6.1). We have shown the importance that our modularity notion has in this result and in others.
We have also extended Varzinczak's investigations (2008) by defining a semantics for action theory revision based on minimal modifications of models. For the corresponding revision algorithms, the reader is referred to the work by Varzinczak (2009). One of our ongoing research topics is on assessing our revision operators' behavior with respect to appropriate versions of the AGM postulates for revision (Alchourrón et al., 1985) and its links with the contraction counterpart.
With our algorithms we provide a set of tools to be used by the knowledge engineer in an interactive and possibly iterative way to modify an action theory. These tools are guaranteed to perform minimal change when assisting the knowledge engineer in implementing her desired modifications. They give her a set of options and it is up to the knowledge engineer to decide which one is more in line with her intuitions.
Given that action theory change is not a single step operation, the knowledge engineer is expected to make use of the contraction/revision operators to make a series of modifications that eventually will give a fine-grained theory not entailing the contracted laws and entailing the new learned laws about the domain.
For the sake of presentation, here we have abstracted from the frame and ramification problems. However our definitions could have been stated in a formalism with a suitable solution to them, like Castilho et al.'s approaches (1999Castilho et al.'s approaches ( , 2002. With regards to the qualification problem, this is not ignored here: contracting wrong executability laws is an approach towards its solution. Indeed, given the difficulty of stating all sufficient conditions for executability of an action, the knowledge engineer writes down some of them and lets the theory 'evolve' via subsequent revisions.
A possible criticism to the approach here developed concerns the cautiousness of our operator for contracting static laws: we prefer to lose some executability laws rather than induce them and lose effect laws. This behavior could make our operators to be interpreted as incoherent. We have pointed out nevertheless that this is in line with largely accepted assumptions in the RAC community, and moreover we have shown the impossibility of a non-cautious static law contraction operator that complies with all that and is coherent with the other operators.
Indeed one of the purposes of the present work is to shed some light on the fundamental differences between belief change in action domain descriptions and in logical theories in general. Classical belief change cannot be fully transplanted to action theories, and here we have shown why (cf. Sections 3.2, 4.2, 5.3 and 8.3).
In particular, looking at the postulates of classical belief change (or our versions thereof) one sees that they are not enough to fully characterize operators for action theory change. For that to be achieved the fundamental assumptions in reasoning about actions that we have extensively used throughout this work should somehow be 'compiled' into postulates supplementing the classical ones. It is not immediately clear what these new postulates would look like, but this is an interesting thread of investigation worth pursuing.
It might also be argued that our semantic operations do not respect the principle of categorical matching, given that the input and output are different sorts of objects, viz. a set of models and a set of sets of models (cf. Definitions 3.3, 3.7 and 3.10). It is easy to see, however, that our semantic constructions could have been defined in such a way that each M ∈ M − Φ corresponds to the result of one contraction operator. The choice for defining the result of an operation as a set of possible outputs was driven by the definition of the algorithms, where a theory (corresponding to a set of models) is given as input and the output is a set of theories (hence corresponding to a set of set of models).
Although the semantic operators can be redefined to satisfy the principle of categorical matching, the same is not immediate about the algorithms (they would be nondeterministic). Therefore we preferred to keep a balance between the semantic and the syntactic definitions so that we see more clearly their direct correspondence.
One of our contentions here is that sticking to modular theories (and hence to canonical models) is not a big deal: we can use existent algorithms in the literature (Herzig & Varzinczak, 2007) to ensure that an action theory T is characterized by its canonical models.
We have seen that under modularity, our operators satisfy all the postulates for contraction: Modularity is one of the sufficient conditions for Success in Theorem 7.1. It is also a sufficient condition in Theorem 7.2, and, as shown in Theorem 7.3, it is a sufficient condition for Recovery. Finally it is also a sufficient condition for the Disjunctive Rule to hold, and is shown to be preserved by the contraction operators (cf. last paragraph of Section 7.2, proof in Appendix B). Preservation of modularity is an important result since it means that it has to be checked/ensured at most once during the lifetime of the action theory. All these results support the thesis that our modularity notion is fruitful.
By forcing formulas to be explicitly stated in their respective modules (and thus possibly making them inferable in independently different ways), modularity intuitively could be seen to diminish elaboration tolerance (McCarthy, 1998). For instance, when contracting a Boolean formula ϕ in a non-modular theory, it seems reasonable to expect not to change the set of static laws S , while the theory being modular surely forces changing such a module. It is not difficult, however, to conceive non-modular theories in which contraction of a formula ϕ may demand a change in S as well. As an example, suppose S = {ϕ 1 → ϕ 2 } in an action theory from whose dynamic part we (implicitly) infer ¬ϕ 2 . In this case, contracting ¬ϕ 1 while keeping ¬ϕ 2 would necessarily ask for a change in S .
We point out nevertheless that in both cases (modular and non-modular) the extra work in changing other modules stays in the mechanical level, i.e., in the algorithms that carry out the modification, and does not augment in a significant way the amount of work the knowledge engineer is expected to do.
Contrary to the trend in the belief change community, where the focus is either on belief bases or belief sets (Hansson, 1999), the method here proposed is a hybrid one (Delgrande, 2009). On one hand, semantics plays a crucial role in the notion of minimal change here studied. On the other hand, we deal only with domain descriptions in reasoning about actions, which are sets of laws of specific types. On top of that, the modularity property (a syntactical one) is fundamental to our main results.
Following those lines, another issue that drives our future research on the subject is how to contract not only laws but any K n -formula. As defined, the order of application of our operators matter in the final result: if we contract ϕ and then ϕ → [a]ψ from a theory T, the result may not be the same as contracting ϕ → [a]ψ first and then removing ϕ. This problem would not appear in a more general framework in which any formula could be contracted: removing ϕ ∧ (ϕ → [a]ψ) should give the same result as (ϕ → [a]ψ) ∧ ϕ. This is the principle of syntax independence (Dalal, 1988).
Related to that is the question on how our revision definitions relate to our contraction operators. What is known is that the Levi identity (1977), T Φ = T − ¬Φ ∪ {Φ}, in general does not hold for action laws (effect and executability ones). The reason is that up to now there is no contraction operator for ¬Φ where Φ is an effect or an executability law. Indeed this is the general contraction problem for non-classical logics: contraction of a general formula (like ¬Φ above) is still an open problem in the belief change area. Some insights in this direction are given by our revision definitions, with which we make ¬Φ false in every possible world of a Kripke model. Definitions 3.1, 3.5 and 3.8 appear to be important for better understanding the problem of contracting general formulas: basically the set of modifications to perform in a given model in order to force it to falsify a general formula will comprise removal/addition of transitions/worlds. The definition of a general revision/contraction method will then benefit from our constructions.
Furthermore, given the well-known connection between multimodal logics and Description Logics (Baader, Calvanese, McGuinness, Nardi, & Patel-Schneider, 2003), we believe that our definitions may also contribute to ontology evolution and debugging in some specific families of DLs.
In order to show that M is a model of T , it is enough to show that it is a model of the added laws. Given (ϕ i ∧¬(π∧ϕ A )) → [a]ψ i ∈ T , for every w ∈ W , if |= with u ϕ. Because we have assumed the syntactical classical contraction operator is sound and complete with respect to its semantics and is moreover minimal, then there must be S − ∈ S ϕ such that W = val(S − ). Therefore |= M S − .
Because R = R, every effect law of T remains true in M .

Now, let
Proof of Theorem 6.3 From the hypothesis that T is modular and Lemma B.1, it follows that T is modular, too. Then M = val(S ), R is a model of T , by Lemma B.3. From this and Lemma B.4 the result follows. 2